15 changed files with 590 additions and 114 deletions
--- a/config/sidebar.php
+++ b/config/sidebar.php
@@ -8,6 +8,8 @@ declare(strict_types=1);
 * This file defines the sidebar sections displayed in the frontend.
 * Each item references the module that owns it via the `module` key.
 * Items whose module is not active (see config/modules.php) are filtered out.
+ * Items may also declare a `permission` key (RBAC permission code) : the item
+ * is hidden from users who do not hold that permission.
 *
 * This config is decoupled from the modules themselves: you can freely
 * move an item from one section to another without touching the module code.
@@ -33,10 +35,18 @@ return [
                'module' => 'core',
            ],
            [
-                'label'  => 'sidebar.core.roles',
-                'to'     => '/admin/roles',
-                'icon'   => 'mdi:shield-account-outline',
-                'module' => 'core',
+                'label'      => 'sidebar.core.roles',
+                'to'         => '/admin/roles',
+                'icon'       => 'mdi:shield-account-outline',
+                'module'     => 'core',
+                'permission' => 'core.roles.view',
+            ],
+            [
+                'label'      => 'sidebar.core.users',
+                'to'         => '/admin/users',
+                'icon'       => 'mdi:account-group-outline',
+                'module'     => 'core',
+                'permission' => 'core.users.view',
            ],
            [
                'label'  => 'sidebar.general.logout',
--- a/frontend/i18n/locales/fr.json
+++ b/frontend/i18n/locales/fr.json
@@ -24,7 +24,8 @@
            "suppliers": "Répertoire fournisseurs"
        },
        "core": {
-            "roles": "Gestion des roles"
+            "roles": "Gestion des rôles",
+            "users": "Utilisateurs"
        }
    },
    "dashboard": {
@@ -62,38 +63,64 @@
    },
    "admin": {
        "roles": {
-            "title": "Gestion des roles",
-            "newRole": "Nouveau role",
-            "editRole": "Modifier le role",
-            "createRole": "Creer un role",
-            "noRoles": "Aucun role configure",
+            "title": "Gestion des rôles",
+            "newRole": "Nouveau rôle",
+            "editRole": "Modifier le rôle",
+            "createRole": "Créer un rôle",
+            "noRoles": "Aucun rôle configuré",
            "table": {
-                "label": "Libelle",
+                "label": "Libellé",
                "code": "Code",
                "permissions": "Permissions",
-                "system": "Systeme",
+                "system": "Système",
                "actions": "Actions"
            },
            "form": {
-                "label": "Libelle",
+                "label": "Libellé",
                "code": "Code",
                "description": "Description",
                "permissions": "Permissions"
            },
            "delete": {
-                "title": "Supprimer le role",
-                "message": "Etes-vous sur de vouloir supprimer le role \"{label}\" ? Cette action est irreversible.",
-                "systemTooltip": "Role systeme non supprimable"
+                "title": "Supprimer le rôle",
+                "message": "Êtes-vous sûr de vouloir supprimer le rôle \"{label}\" ? Cette action est irréversible.",
+                "systemTooltip": "Rôle système non supprimable"
            },
            "toast": {
-                "created": "Role cree avec succes",
-                "updated": "Role mis a jour avec succes",
-                "deleted": "Role supprime avec succes"
+                "created": "Rôle créé avec succès",
+                "updated": "Rôle mis à jour avec succès",
+                "deleted": "Rôle supprimé avec succès"
            },
            "permissions": {
                "selectAll": "Tout selectionner",
                "noPermissions": "Aucune permission disponible"
            }
+        },
+        "users": {
+            "title": "Gestion des utilisateurs",
+            "noUsers": "Aucun utilisateur",
+            "table": {
+                "username": "Nom d'utilisateur",
+                "admin": "Administrateur",
+                "roles": "Roles",
+                "directPermissions": "Permissions directes",
+                "actions": "Actions"
+            },
+            "drawer": {
+                "title": "Permissions de {username}",
+                "selfWarning": "Vous modifiez vos propres droits",
+                "adminToggle": "Administrateur (bypass total)",
+                "rolesSection": "Rôles",
+                "directPermissionsSection": "Permissions directes",
+                "summarySection": "Résumé des permissions effectives",
+                "noEffectivePermissions": "Aucune permission effective",
+                "sourceRole": "via {role}",
+                "sourceDirect": "Direct",
+                "lastAdminWarning": "Impossible de retirer le statut administrateur du dernier admin"
+            },
+            "toast": {
+                "updated": "Permissions mises à jour avec succès"
+            }
        }
    }
 }
--- a/frontend/modules/core/components/EffectivePermissions.vue
+++ b/frontend/modules/core/components/EffectivePermissions.vue
@@ -0,0 +1,68 @@
+<template>
+    <div>
+        <div v-if="permissions.length === 0" class="text-sm text-neutral-400">
+            {{ t('admin.users.drawer.noEffectivePermissions') }}
+        </div>
+        <div v-else class="divide-y divide-neutral-100 rounded-lg border border-neutral-200">
+            <div
+                v-for="perm in groupedPermissions"
+                :key="perm.module"
+                class="px-4 py-2"
+            >
+                <!-- En-tête du module -->
+                <p class="text-xs font-semibold uppercase text-neutral-400 mb-1">
+                    {{ perm.module }}
+                </p>
+                <div
+                    v-for="item in perm.items"
+                    :key="item.code"
+                    class="flex items-center justify-between py-1"
+                >
+                    <span class="text-sm text-neutral-700">{{ item.label }}</span>
+                    <div class="flex gap-1">
+                        <span
+                            v-for="source in item.sources"
+                            :key="source"
+                            :class="[
+                                'inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium',
+                                source === t('admin.users.drawer.sourceDirect')
+                                    ? 'bg-green-100 text-green-800'
+                                    : 'bg-blue-100 text-blue-800'
+                            ]"
+                        >
+                            {{ source }}
+                        </span>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+</template>
+
+<script setup lang="ts">
+import type { EffectivePermission } from '~/shared/types/rbac'
+
+const { t } = useI18n()
+
+const props = defineProps<{
+    permissions: EffectivePermission[]
+}>()
+
+// Grouper par module pour l'affichage
+interface PermissionModuleGroup {
+    module: string
+    items: EffectivePermission[]
+}
+
+const groupedPermissions = computed<PermissionModuleGroup[]>(() => {
+    const groups = new Map<string, EffectivePermission[]>()
+    for (const perm of props.permissions) {
+        const list = groups.get(perm.module) || []
+        list.push(perm)
+        groups.set(perm.module, list)
+    }
+    return Array.from(groups.entries())
+        .map(([module, items]) => ({ module, items }))
+        .sort((a, b) => a.module.localeCompare(b.module))
+})
+</script>
--- a/frontend/modules/core/components/PermissionGroup.vue
+++ b/frontend/modules/core/components/PermissionGroup.vue
@@ -30,13 +30,7 @@
 </template>

 <script setup lang="ts">
-interface Permission {
-    id: number
-    code: string
-    label: string
-    module: string
-    orphan: boolean
-}
+import type { Permission } from '~/shared/types/rbac'

 const props = defineProps<{
    module: string
--- a/frontend/modules/core/components/RoleDeleteModal.vue
+++ b/frontend/modules/core/components/RoleDeleteModal.vue
@@ -55,6 +55,14 @@ function cancel() {
 function confirm() {
    emit('confirm')
 }
+
+// Fermer la modale avec la touche Escape
+function onKeydown(e: KeyboardEvent) {
+    if (e.key === 'Escape') cancel()
+}
+
+onMounted(() => document.addEventListener('keydown', onKeydown))
+onUnmounted(() => document.removeEventListener('keydown', onKeydown))
 </script>

 <style scoped>
--- a/frontend/modules/core/components/RoleDrawer.vue
+++ b/frontend/modules/core/components/RoleDrawer.vue
@@ -19,8 +19,7 @@
                :label="t('admin.roles.form.code')"
                input-class="w-full"
                required
-                :readonly="isEditMode && role?.isSystem"
-                :hint="isEditMode && role?.isSystem ? t('admin.roles.delete.systemTooltip') : ''"
+                :readonly="isEditMode"
            />

            <MalioInputTextArea
@@ -70,22 +69,7 @@
 </template>

 <script setup lang="ts">
-interface Permission {
-    id: number
-    code: string
-    label: string
-    module: string
-    orphan: boolean
-}
-
-interface Role {
-    id: number
-    code: string
-    label: string
-    description: string | null
-    isSystem: boolean
-    permissions: (Permission | string)[]
-}
+import type { Permission, Role } from '~/shared/types/rbac'

 interface PermissionModule {
    module: string
@@ -136,7 +120,7 @@ const permissionsByModule = computed<PermissionModule[]>(() => {
 async function loadPermissions() {
    const data = await api.get<{ member: Permission[] }>(
        '/permissions',
-        { 'orphan': false, itemsPerPage: 200 },
+        { 'orphan': false, itemsPerPage: 999 },
        { toast: false },
    )
    allPermissions.value = data.member
@@ -198,19 +182,24 @@ function handleToggleAll(module: string, selected: boolean) {
 async function handleSave() {
    saving.value = true
    try {
-        const body = {
-            label: form.value.label,
-            code: form.value.code,
-            description: form.value.description || null,
-            permissions: Array.from(selectedPermissionIds.value).map(id => `/api/permissions/${id}`),
-        }
+        const permissions = Array.from(selectedPermissionIds.value).map(id => `/api/permissions/${id}`)

        if (isEditMode.value && props.role) {
-            await api.patch(`/roles/${props.role.id}`, body, {
+            // Le code est immuable apres creation (garde backend RoleProcessor)
+            await api.patch(`/roles/${props.role.id}`, {
+                label: form.value.label,
+                description: form.value.description || null,
+                permissions,
+            }, {
                toastSuccessMessage: t('admin.roles.toast.updated'),
            })
        } else {
-            await api.post('/roles', body, {
+            await api.post('/roles', {
+                label: form.value.label,
+                code: form.value.code,
+                description: form.value.description || null,
+                permissions,
+            }, {
                toastSuccessMessage: t('admin.roles.toast.created'),
            })
        }
--- a/frontend/modules/core/components/UserRbacDrawer.vue
+++ b/frontend/modules/core/components/UserRbacDrawer.vue
@@ -0,0 +1,259 @@
+<template>
+    <MalioDrawer
+        :model-value="modelValue"
+        :title="t('admin.users.drawer.title', { username: user?.username ?? '' })"
+        drawer-class="w-full max-w-lg"
+        @update:model-value="emit('update:modelValue', $event)"
+    >
+        <div class="flex flex-col gap-6 p-4">
+            <!-- Avertissement auto-edition -->
+            <div
+                v-if="isSelfEdit"
+                class="flex items-center gap-2 rounded-lg border border-yellow-300 bg-yellow-50 px-4 py-3 text-sm text-yellow-800"
+            >
+                <Icon name="mdi:alert-outline" class="size-5 shrink-0" />
+                {{ t('admin.users.drawer.selfWarning') }}
+            </div>
+
+            <!-- Toggle Administrateur -->
+            <MalioCheckbox
+                id="admin-toggle"
+                :label="t('admin.users.drawer.adminToggle')"
+                :model-value="form.isAdmin"
+                label-class="font-semibold text-sm text-neutral-700"
+                @update:model-value="form.isAdmin = $event"
+            />
+
+            <!-- Section Roles -->
+            <div>
+                <h4 class="mb-3 text-sm font-semibold text-neutral-700">
+                    {{ t('admin.users.drawer.rolesSection') }}
+                </h4>
+                <div class="flex flex-col gap-2">
+                    <MalioCheckbox
+                        v-for="role in allRoles"
+                        :key="role.id"
+                        :id="`role-${role.id}`"
+                        :label="role.label"
+                        :model-value="selectedRoleIds.has(role.id)"
+                        label-class="text-sm text-neutral-600"
+                        @update:model-value="(val: boolean) => toggleRole(role.id, val)"
+                    />
+                </div>
+            </div>
+
+            <!-- Section Permissions directes -->
+            <div>
+                <h4 class="mb-3 text-sm font-semibold text-neutral-700">
+                    {{ t('admin.users.drawer.directPermissionsSection') }}
+                </h4>
+                <div v-if="permissionsByModule.length === 0" class="text-sm text-neutral-400">
+                    {{ t('admin.roles.permissions.noPermissions') }}
+                </div>
+                <div class="flex flex-col gap-4">
+                    <PermissionGroup
+                        v-for="group in permissionsByModule"
+                        :key="group.module"
+                        :module="group.module"
+                        :module-label="group.module"
+                        :permissions="group.permissions"
+                        :selected-ids="selectedDirectPermissionIds"
+                        @toggle="handleTogglePermission"
+                        @toggle-all="handleToggleAll"
+                    />
+                </div>
+            </div>
+
+            <!-- Section Resume permissions effectives -->
+            <div>
+                <h4 class="mb-3 text-sm font-semibold text-neutral-700">
+                    {{ t('admin.users.drawer.summarySection') }}
+                </h4>
+                <EffectivePermissions :permissions="effectivePermissions" />
+            </div>
+
+            <!-- Boutons -->
+            <div class="flex justify-end gap-3 border-t border-neutral-200 pt-4">
+                <MalioButton
+                    :label="t('common.cancel')"
+                    variant="secondary"
+                    @click="emit('update:modelValue', false)"
+                />
+                <MalioButton
+                    :label="t('common.save')"
+                    variant="primary"
+                    :disabled="saving"
+                    @click="handleSave"
+                />
+            </div>
+        </div>
+    </MalioDrawer>
+</template>
+
+<script setup lang="ts">
+import type { Permission, Role, UserListItem, EffectivePermission } from '~/shared/types/rbac'
+
+interface PermissionModule {
+    module: string
+    permissions: Permission[]
+}
+
+const { t } = useI18n()
+const api = useApi()
+const auth = useAuthStore()
+
+const props = defineProps<{
+    modelValue: boolean
+    user: UserListItem | null
+}>()
+
+const emit = defineEmits<{
+    'update:modelValue': [value: boolean]
+    saved: []
+}>()
+
+const saving = ref(false)
+const allRoles = ref<Role[]>([])
+const allPermissions = ref<Permission[]>([])
+
+const form = ref({ isAdmin: false })
+const selectedRoleIds = ref(new Set<number>())
+const selectedDirectPermissionIds = ref(new Set<number>())
+
+// Detecter l'auto-edition
+const isSelfEdit = computed(() => props.user?.id === auth.user?.id)
+
+// Extraire un ID depuis une IRI API Platform
+function iriToId(iri: string): number {
+    return Number(iri.split('/').pop())
+}
+
+// Grouper les permissions par module (pour les checkboxes)
+const permissionsByModule = computed<PermissionModule[]>(() => {
+    const groups = new Map<string, Permission[]>()
+    for (const perm of allPermissions.value) {
+        if (perm.orphan) continue
+        const list = groups.get(perm.module) || []
+        list.push(perm)
+        groups.set(perm.module, list)
+    }
+    return Array.from(groups.entries())
+        .map(([module, permissions]) => ({ module, permissions }))
+        .sort((a, b) => a.module.localeCompare(b.module))
+})
+
+// Calculer les permissions effectives avec leurs sources
+const effectivePermissions = computed<EffectivePermission[]>(() => {
+    const permMap = new Map<number, Permission>()
+    for (const p of allPermissions.value) {
+        if (!p.orphan) permMap.set(p.id, p)
+    }
+
+    // Construire la map permissionId -> sources[]
+    const result = new Map<number, string[]>()
+
+    // Permissions heritees des roles
+    for (const roleId of selectedRoleIds.value) {
+        const role = allRoles.value.find(r => r.id === roleId)
+        if (!role) continue
+        for (const p of role.permissions) {
+            const pid = typeof p === 'string' ? iriToId(p) : p.id
+            const sources = result.get(pid) || []
+            sources.push(t('admin.users.drawer.sourceRole', { role: role.label }))
+            result.set(pid, sources)
+        }
+    }
+
+    // Permissions directes
+    for (const pid of selectedDirectPermissionIds.value) {
+        const sources = result.get(pid) || []
+        sources.push(t('admin.users.drawer.sourceDirect'))
+        result.set(pid, sources)
+    }
+
+    // Construire la liste finale
+    return Array.from(result.entries())
+        .map(([pid, sources]) => {
+            const perm = permMap.get(pid)
+            if (!perm) return null
+            return { code: perm.code, label: perm.label, module: perm.module, sources }
+        })
+        .filter((p): p is EffectivePermission => p !== null)
+        .sort((a, b) => a.code.localeCompare(b.code))
+})
+
+// Charger roles et permissions
+async function loadData() {
+    const [rolesData, permsData] = await Promise.all([
+        api.get<{ member: Role[] }>('/roles', {}, { toast: false }),
+        api.get<{ member: Permission[] }>('/permissions', { orphan: false, itemsPerPage: 999 }, { toast: false }),
+    ])
+    allRoles.value = rolesData.member
+    allPermissions.value = permsData.member
+}
+
+// Remplir le formulaire quand le user change
+watch(() => props.user, (user) => {
+    if (user) {
+        form.value.isAdmin = user.isAdmin
+        selectedRoleIds.value = new Set(user.roles.map(iriToId))
+        selectedDirectPermissionIds.value = new Set(user.directPermissions.map(iriToId))
+    } else {
+        form.value.isAdmin = false
+        selectedRoleIds.value = new Set()
+        selectedDirectPermissionIds.value = new Set()
+    }
+}, { immediate: true })
+
+// Charger les donnees quand le drawer s'ouvre
+watch(() => props.modelValue, (open) => {
+    if (open) loadData()
+})
+
+function toggleRole(id: number, selected: boolean) {
+    const ids = new Set(selectedRoleIds.value)
+    if (selected) ids.add(id)
+    else ids.delete(id)
+    selectedRoleIds.value = ids
+}
+
+function handleTogglePermission(id: number, selected: boolean) {
+    const ids = new Set(selectedDirectPermissionIds.value)
+    if (selected) ids.add(id)
+    else ids.delete(id)
+    selectedDirectPermissionIds.value = ids
+}
+
+function handleToggleAll(module: string, selected: boolean) {
+    const ids = new Set(selectedDirectPermissionIds.value)
+    const group = permissionsByModule.value.find(g => g.module === module)
+    if (!group) return
+    for (const perm of group.permissions) {
+        if (selected) ids.add(perm.id)
+        else ids.delete(perm.id)
+    }
+    selectedDirectPermissionIds.value = ids
+}
+
+async function handleSave() {
+    if (!props.user) return
+    saving.value = true
+    try {
+        await api.patch(`/users/${props.user.id}/rbac`, {
+            isAdmin: form.value.isAdmin,
+            roles: Array.from(selectedRoleIds.value).map(id => `/api/roles/${id}`),
+            directPermissions: Array.from(selectedDirectPermissionIds.value).map(id => `/api/permissions/${id}`),
+        }, {
+            toastSuccessMessage: t('admin.users.toast.updated'),
+        })
+        // Rafraichir les donnees du user courant si auto-edition
+        if (isSelfEdit.value) {
+            await auth.refreshUser()
+        }
+        emit('saved')
+        emit('update:modelValue', false)
+    } finally {
+        saving.value = false
+    }
+}
+</script>
--- a/frontend/modules/core/pages/admin/roles.vue
+++ b/frontend/modules/core/pages/admin/roles.vue
@@ -19,7 +19,7 @@
            :columns="columns"
            :items="roleItems"
            :total-items="roles.length"
-            :row-clickable="true"
+            :row-clickable="canManage"
            :empty-message="t('admin.roles.noRoles')"
            @row-click="onRowClick"
        >
@@ -76,26 +76,12 @@
 </template>

 <script setup lang="ts">
-interface Permission {
-    id: number
-    code: string
-    label: string
-    module: string
-    orphan: boolean
-}
-
-interface Role {
-    id: number
-    code: string
-    label: string
-    description: string | null
-    isSystem: boolean
-    permissions: (Permission | string)[]
-}
+import type { Role } from '~/shared/types/rbac'

 const { t } = useI18n()
 const api = useApi()
 const { can } = usePermissions()
+const canManage = computed(() => can('core.roles.manage'))

 useHead({ title: t('admin.roles.title') })

--- a/frontend/modules/core/pages/admin/users.vue
+++ b/frontend/modules/core/pages/admin/users.vue
@@ -0,0 +1,120 @@
+<template>
+    <div>
+        <!-- En-tete -->
+        <div class="flex items-center justify-between">
+            <h1 class="text-xl font-bold text-primary-500 sm:text-2xl">
+                {{ t('admin.users.title') }}
+            </h1>
+        </div>
+
+        <!-- Table des utilisateurs -->
+        <MalioDataTable
+            class="mt-6"
+            :columns="columns"
+            :items="userItems"
+            :total-items="users.length"
+            :row-clickable="canManage"
+            :empty-message="t('admin.users.noUsers')"
+            @row-click="onRowClick"
+        >
+            <template #cell-admin="{ item }">
+                <span
+                    v-if="item.admin"
+                    class="inline-flex items-center rounded-full bg-purple-100 px-2.5 py-0.5 text-xs font-medium text-purple-800"
+                >
+                    {{ t('admin.users.table.admin') }}
+                </span>
+            </template>
+            <template #cell-actions="{ item }">
+                <div class="flex items-center justify-end gap-2" @click.stop>
+                    <MalioButtonIcon
+                        v-if="canManage"
+                        icon="mdi:shield-edit-outline"
+                        :aria-label="t('common.edit')"
+                        variant="ghost"
+                        @click="openDrawer(getUserById(item.id as number)!)"
+                    />
+                </div>
+            </template>
+        </MalioDataTable>
+
+        <!-- Drawer RBAC -->
+        <UserRbacDrawer
+            v-model="drawerOpen"
+            :user="selectedUser"
+            @saved="onUserSaved"
+        />
+    </div>
+</template>
+
+<script setup lang="ts">
+import type { UserListItem } from '~/shared/types/rbac'
+
+const { t } = useI18n()
+const api = useApi()
+const { can } = usePermissions()
+
+useHead({ title: t('admin.users.title') })
+
+const canManage = computed(() => can('core.users.manage'))
+
+const users = ref<UserListItem[]>([])
+const loading = ref(false)
+const drawerOpen = ref(false)
+const selectedUser = ref<UserListItem | null>(null)
+
+const columns = [
+    { key: 'username', label: t('admin.users.table.username') },
+    { key: 'admin', label: t('admin.users.table.admin') },
+    { key: 'roles', label: t('admin.users.table.roles') },
+    { key: 'directPermissions', label: t('admin.users.table.directPermissions') },
+    { key: 'actions', label: t('admin.users.table.actions') },
+]
+
+const userItems = computed(() =>
+    users.value.map(user => ({
+        id: user.id,
+        username: user.username,
+        admin: user.isAdmin,
+        roles: user.roles.length,
+        directPermissions: user.directPermissions.length,
+        actions: '',
+    }))
+)
+
+async function loadUsers() {
+    loading.value = true
+    try {
+        const data = await api.get<{ member: UserListItem[] }>(
+            '/users',
+            {},
+            { toast: false },
+        )
+        users.value = data.member
+    } finally {
+        loading.value = false
+    }
+}
+
+function getUserById(id: number): UserListItem | undefined {
+    return users.value.find(u => u.id === id)
+}
+
+function openDrawer(user: UserListItem) {
+    selectedUser.value = user
+    drawerOpen.value = true
+}
+
+function onRowClick(item: Record<string, unknown>) {
+    const user = getUserById(item.id as number)
+    if (user) openDrawer(user)
+}
+
+function onUserSaved() {
+    loadUsers()
+}
+
+onMounted(() => {
+    loadUsers()
+})
+</script>
--- a/frontend/shared/types/rbac.ts
+++ b/frontend/shared/types/rbac.ts
@@ -0,0 +1,31 @@
+export interface Permission {
+    id: number
+    code: string
+    label: string
+    module: string
+    orphan: boolean
+}
+
+export interface Role {
+    id: number
+    code: string
+    label: string
+    description: string | null
+    isSystem: boolean
+    permissions: (Permission | string)[]
+}
+
+export interface UserListItem {
+    id: number
+    username: string
+    isAdmin: boolean
+    roles: string[]
+    directPermissions: string[]
+}
+
+export interface EffectivePermission {
+    code: string
+    label: string
+    module: string
+    sources: string[]
+}
--- a/src/Module/Core/CoreModule.php
+++ b/src/Module/Core/CoreModule.php
@@ -34,7 +34,6 @@ final class CoreModule
            ['code' => 'core.users.manage', 'label' => 'Gerer les utilisateurs (creer, editer, supprimer)'],
            ['code' => 'core.roles.view', 'label' => 'Voir les roles RBAC'],
            ['code' => 'core.roles.manage', 'label' => 'Gerer les roles et permissions'],
-            ['code' => 'core.permissions.view', 'label' => 'Voir le catalogue des permissions'],
        ];
    }
 }
--- a/src/Module/Core/Domain/Entity/Permission.php
+++ b/src/Module/Core/Domain/Entity/Permission.php
@@ -19,11 +19,11 @@ use Symfony\Component\Serializer\Attribute\Groups;
    operations: [
        new GetCollection(
            normalizationContext: ['groups' => ['permission:read']],
-            security: "is_granted('core.permissions.view')",
+            security: "is_granted('ROLE_USER')",
        ),
        new Get(
            normalizationContext: ['groups' => ['permission:read']],
-            security: "is_granted('core.permissions.view')",
+            security: "is_granted('ROLE_USER')",
        ),
    ],
 )]
--- a/src/Module/Core/Domain/Security/AdminHeadcountGuard.php
+++ b/src/Module/Core/Domain/Security/AdminHeadcountGuard.php
@@ -53,6 +53,13 @@ final class AdminHeadcountGuard implements AdminHeadcountGuardInterface
     * La verification est volontairement conservative (<=1) pour couvrir
     * le cas defensif ou la base serait deja dans un etat incoherent (0 admin).
     *
+     * TOCTOU accepte : la verification n'utilise pas de verrou pessimiste
+     * (SELECT ... FOR UPDATE). Deux demotions concurrentes pourraient donc
+     * passer le garde simultanement. Ce risque est accepte dans le contexte
+     * PME/CRM ou les operations d'administration sont rares et mono-operateur.
+     * Si la concurrence admin devient un enjeu, ajouter un verrou pessimiste
+     * sur countAdmins() ou une contrainte CHECK en base.
+     *
     * @throws LastAdminProtectionException si le nombre d'admins est inferieur ou egal a 1
     */
    private function checkAdminHeadcount(): void
--- a/src/Shared/Infrastructure/ApiPlatform/State/SidebarProvider.php
+++ b/src/Shared/Infrastructure/ApiPlatform/State/SidebarProvider.php
@@ -7,6 +7,7 @@ namespace App\Shared\Infrastructure\ApiPlatform\State;
 use ApiPlatform\Metadata\Operation;
 use ApiPlatform\State\ProviderInterface;
 use App\Shared\Infrastructure\ApiPlatform\Resource\SidebarResource;
+use Symfony\Bundle\SecurityBundle\Security;

 /**
 * @implements ProviderInterface<object>
@@ -16,10 +17,10 @@ class SidebarProvider implements ProviderInterface
    /** @var list<string> */
    private readonly array $activeModuleIds;

-    /** @var list<array{label: string, icon: string, items: list<array{label: string, to: string, icon: string, module: string}>}> */
+    /** @var list<array{label: string, icon: string, items: list<array{label: string, to: string, icon: string, module: string, permission?: string}>}> */
    private readonly array $sidebarConfig;

-    public function __construct()
+    public function __construct(private readonly Security $security)
    {
        $configDir = dirname(__DIR__, 5).'/config';

@@ -58,6 +59,18 @@ class SidebarProvider implements ProviderInterface
                    continue;
                }

+                // Filtrage par permission RBAC : si l'item declare une permission
+                // requise et que l'utilisateur courant ne la possede pas, l'item
+                // est masque et sa route ajoutee aux routes desactivees.
+                $requiredPermission = $item['permission'] ?? null;
+                if (null !== $requiredPermission && !$this->security->isGranted($requiredPermission)) {
+                    if (isset($item['to'])) {
+                        $disabledRoutes[] = $item['to'];
+                    }
+
+                    continue;
+                }
+
                $items[] = [
                    'label' => $item['label'],
                    'to'    => $item['to'],
--- a/tests/Module/Core/Api/PermissionApiTest.php
+++ b/tests/Module/Core/Api/PermissionApiTest.php
@@ -166,51 +166,16 @@ final class PermissionApiTest extends AbstractApiTestCase
        self::assertResponseStatusCodeSame(401);
    }

-    public function testNonAdminReturns403(): void
+    public function testStandardUserCanListPermissions(): void
    {
+        // Le catalogue de permissions est accessible a tout utilisateur authentifie.
        $client = $this->authenticatedClient('alice', 'alice');
        $client->request('GET', '/api/permissions');

-        self::assertResponseStatusCodeSame(403);
-    }
-
-    // --- Tests voter RBAC : non-admin avec / sans permission ---
-
-    public function testListPermissionsAsUserWithViewPermissionReturns200(): void
-    {
-        // Un non-admin portant core.permissions.view doit pouvoir lister.
-        $credentials = $this->createUserWithPermission('core.permissions.view');
-        $client      = $this->authenticatedClient($credentials['username'], $credentials['password']);
-        $client->request('GET', '/api/permissions');
-
        self::assertResponseIsSuccessful();
    }

-    public function testListPermissionsAsStandardUserReturns403(): void
-    {
-        // alice n'a aucune permission RBAC : acces refuse.
-        $client = $this->authenticatedClient('alice', 'alice');
-        $client->request('GET', '/api/permissions');
-
-        self::assertResponseStatusCodeSame(403);
-    }
-
-    public function testGetPermissionAsUserWithViewPermissionReturns200(): void
-    {
-        // Recupere l'id d'une permission existante pour construire l'URL GET item.
-        $permission = $this->getEm()->getRepository(Permission::class)
-            ->findOneBy(['code' => 'test.core.users.view'])
-        ;
-        self::assertNotNull($permission);
-
-        $credentials = $this->createUserWithPermission('core.permissions.view');
-        $client      = $this->authenticatedClient($credentials['username'], $credentials['password']);
-        $client->request('GET', '/api/permissions/'.$permission->getId());
-
-        self::assertResponseIsSuccessful();
-    }
-
-    public function testGetPermissionAsStandardUserReturns403(): void
+    public function testStandardUserCanGetPermission(): void
    {
        $permission = $this->getEm()->getRepository(Permission::class)
            ->findOneBy(['code' => 'test.core.users.view'])
@@ -220,7 +185,7 @@ final class PermissionApiTest extends AbstractApiTestCase
        $client = $this->authenticatedClient('alice', 'alice');
        $client->request('GET', '/api/permissions/'.$permission->getId());

-        self::assertResponseStatusCodeSame(403);
+        self::assertResponseIsSuccessful();
    }

    private function cleanupTestPermissions(): void